What was published, and from when it applies
Legislative decree no. 179 of 7 October 2026 was published in Official Gazette no. 234 of 8 October 2026 and entered into force on 23 October 2026. It covers several areas; on employment the two articles that matter are Article 41, on automated decisions in the employment relationship, and Article 42, which brings artificial intelligence systems into the risk assessment under Article 28 of decree 81/2008 and requires specific information and training. The prior notice remains the one under Article 1-bis of decree 152/1997.
The part that really changes the job is one line. Article 41 states that final decisions on the employment relationship cannot be based solely on automated processing, that the worker is entitled, on request, to an understandable explanation of the decision, and at paragraph 4 that decisions taken in breach of these rules are void. Not «voidable on appeal»: void. A dismissal, a non-renewal, a change of duties decided by the system alone produce no effect, and that holds regardless of how good the model is and how large the administrative fine might be.
It is worth pausing on the word «solely», because everything turns on it and because it is the same word as in Article 22 GDPR, with ten years of argument behind it. An HR manager who receives a ranking generated by the system, has no way of contesting it, does not know the criteria and signs off what the system proposes, is not human intervention: that is a signature. The intervention that takes the decision outside the rule is by someone with the authority and the information to change it, and who sometimes actually changes it.
- It applies to FINAL decisions on the relationship: hiring, modification, termination. An automated filter upstream of a real interview is a different thing, but it still has to be declared.
- The explanation must be given on request and must be understandable: «the system assigned a score of 42» is not an explanation, it is a number.
- The notice under Article 1-bis of decree 152/1997 must be given BEFORE the processing starts, and covers decision-making and monitoring systems too.
- AI systems affecting work organisation, production rhythms or how work is performed go into the risk assessment, not into a separate annex.
- Workers need information and training on the specific risks of those systems and on the measures adopted.
AI in the risk assessment is not one more chapter
On this point commentators disagree, and it is worth knowing before advising a client. Some hold that adding an artificial intelligence chapter to the risk assessment document is enough; others argue a broader revision is needed. The second view holds up better, for a practical reason: a generic AI annex, disconnected from the assessments already made on work-related stress, ergonomics and machinery risk, describes a system that does not exist in the rest of the document. An inspector comparing the two parts finds a document talking to itself. On the other hand not every new application automatically requires a formal update: the test is whether it affects organisation, rhythms or safety, not whether it contains a model.
The Italian picture adds to what the data protection authority had already said. In a decision of 14 May 2026 the authority addressed artificial intelligence systems in the workplace, in particular tools that analyse workers' emotional or psychological aspects, with a principle that is simple to state and uncomfortable to apply: the employer must not come to know, even indirectly, information about the emotional or psychological sphere of those who work for them. A system measuring tone of voice on a customer service call, or posture in front of a camera, falls inside it even when the vendor calls it «quality analysis».
For a DPO there are three things to ask the client, and the first is often disarming. Which systems already in the building produce a score, a ranking or an alert about a person? Almost always the first answer is «none», and almost always what then surfaces is the shift-scheduling software, the warehouse productivity tool, the CV filter in the recruitment portal. None of these was bought as «artificial intelligence», and that is exactly why they are not in the register.
The other two are quicker. Who signs the final decision, and do they genuinely have the power to depart from the suggestion? And what is said to the worker who asks why. It is worth writing that answer before anyone asks for it: a text prepared calmly, with the criteria and the weight of each, is a compliance document; the same text written in a hurry after a complaint is a justification, and it shows.
Official source:Gazzetta Ufficiale — decree no. 179 of 7 October 2026 (OG no. 234 of 8 October 2026)Official source:PuntoSicuro — AI Act and decree 179/2026: impact and duties for occupational safetyOfficial source:Garante per la protezione dei dati personali — decisionsLooking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free